solana-dev

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The workflow runs cargo install --git https://github.com/coral-xyz/anchor ... (deployment.md lines 247-250), which fetches and builds remote code at CI/runtime and thus executes external code from that URL.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill hub explicitly references protocol-specific skills and payment integrations that are designed to move money on-chain: e.g., Jupiter (swaps, DCA, limit orders), payment flows / Solana Pay, Phantom wallet connection, and multisig (Squads). These are specific crypto/blockchain financial execution capabilities (swaps, orders, wallet signing, payments), so the skill grants direct financial execution authority.